🛡️ 10-01: IDS/IPS Concepts¶
📌 What Is an IDS?¶
An IDS (Intrusion Detection System) is a tool (hardware appliance or software) that monitors network traffic or system activity and raises an alert when it spots something that looks malicious or policy-violating.
💡 Think of an IDS like a burglar alarm: it watches for suspicious activity and notifies someone — it does not physically stop the intruder.
Key Property: Detection Only¶
- An IDS is typically deployed passively — it inspects a copy of the traffic (via a mirror/SPAN port or a network tap)
- It does not sit in the direct path of the traffic
- Its only action is to log the event and/or send an alert (email, dashboard, SIEM ticket)
📌 What Is an IPS?¶
An IPS (Intrusion Prevention System) does everything an IDS does, but takes it a step further: it can actively block or stop the malicious traffic before it reaches its target.
💡 Think of an IPS like a security guard with the authority to slam the door shut, not just sound an alarm.
Key Property: Prevention¶
- An IPS is deployed inline — all traffic must physically pass through it
- It can drop packets, reset connections, or block an IP address in real time
- Because it sits inline, a misconfigured IPS can become a single point of failure or a bottleneck for legitimate traffic
⚖️ IDS vs. IPS: Detection vs. Prevention¶
| Feature | IDS (Detection) | IPS (Prevention) |
|---|---|---|
| Placement | Out-of-band (monitors a copy of traffic) | Inline (traffic passes through it) |
| Action on threat | Alert / log only | Block, drop, or reset the connection |
| Impact of a false positive | Analyst gets a noisy alert | Legitimate traffic gets blocked |
| Failure mode | Traffic still flows if the IDS crashes | Traffic may stop entirely if the IPS fails ("fail closed") or bypass security if it "fails open" |
| Response speed | Human/analyst reacts after the fact | Automatic, real-time |
💡 Key idea: the same detection engine (signatures, anomaly rules) can power both an IDS and an IPS — the difference is mainly placement (out-of-band vs. inline) and what happens after a match.
🔍 Two Detection Approaches¶
Regardless of whether the system only detects (IDS) or also blocks (IPS), it needs a method for deciding "is this traffic malicious?" There are two dominant approaches.
1️⃣ Signature-Based Detection¶
Signature-based detection works like antivirus software: it maintains a database of known attack patterns (signatures) — specific byte sequences, packet headers, or behavior patterns tied to known exploits — and flags any traffic that matches one.
Example: A signature might say "flag any packet whose payload contains the exact string /etc/passwd combined with an HTTP request to a login form" (a known web exploit pattern).
Process: 1. Security researchers analyze a new attack (e.g., a worm or exploit) 2. They extract a unique "fingerprint" of that attack 3. The fingerprint is added to the signature database 4. The IDS/IPS compares live traffic against every known signature
| Pros | Cons |
|---|---|
| Very low false-positive rate for known attacks | Blind to novel (zero-day) attacks — no signature exists yet |
| Fast and computationally cheap to match | Signature database must be constantly updated |
| Easy to understand why something was flagged | Attackers can evade with small variations (polymorphism) |
2️⃣ Anomaly-Based Detection¶
Anomaly-based detection takes a different approach: it first builds a baseline of "normal" behavior (e.g., typical traffic volume, typical login times, typical protocols used) and then flags anything that deviates significantly from that baseline.
Example: If a server normally handles 50 SSH login attempts a day and suddenly sees 5,000 attempts in one minute, an anomaly-based system flags this as suspicious — even though no specific "signature" for this exact attack exists.
Process: 1. Collect a large sample of traffic considered "normal" 2. Build a statistical or machine-learning model of that normal behavior 3. Compare new traffic against the model 4. Flag anything that falls outside the expected range
| Pros | Cons |
|---|---|
| Can catch zero-day / never-seen-before attacks | Higher false-positive rate (unusual ≠ always malicious) |
| Adapts to the specific environment it monitors | Requires a clean, representative baseline of normal traffic |
| Doesn't rely on a signature database | More computationally expensive; harder to explain why something was flagged |
⚖️ Signature-Based vs. Anomaly-Based¶
| Feature | Signature-Based | Anomaly-Based |
|---|---|---|
| Detects known attacks | ✅ Excellent | ⚠️ Only if they deviate from baseline |
| Detects novel/zero-day attacks | ❌ No | ✅ Yes |
| False positive rate | Low | Higher |
| Maintenance | Requires signature updates | Requires baseline retraining |
| Real-world analogy | Antivirus scanning for known malware | A bank noticing "unusual" account activity |
💡 This is exactly why Module 10 introduces machine learning (see 10-03: Intro to ML for Security): ML is a modern, data-driven way to build the "normal baseline" used in anomaly-based detection, rather than hand-writing statistical rules.
🧩 Hybrid Approach¶
Most real-world commercial products (e.g., Snort, Suricata, enterprise EDR tools) use both techniques together:
- Signature-based rules catch the 90% of attacks that are already well-known cheaply and accurately
- Anomaly-based / behavioral rules act as a safety net for anything new or unusual
📌 Key Takeaways¶
- An IDS detects and alerts; an IPS detects and actively blocks — the core difference is placement (out-of-band vs. inline) and action taken.
- IDS is passive and low-risk to deploy; IPS is active but introduces a potential bottleneck or single point of failure.
- Signature-based detection matches traffic against a database of known attack patterns — fast and accurate, but blind to new attacks.
- Anomaly-based detection flags deviations from a learned baseline of normal behavior — catches novel attacks, but produces more false positives.
- Neither approach alone is sufficient; mature systems combine both.
- Anomaly-based detection is the conceptual foundation for applying machine learning to intrusion detection, covered later in this module.